Cisco ISE’s maximum-severity login bypass is under active attack

Cisco disclosed CVE-2026-76460 on 16 September. An API weakness in Identity Services Engine (ISE) and ISE-PIC can let an unauthenticated remote attacker bypass the web-management login. Cisco rated the flaw 10.0 and said its Product Security Incident Response Team was aware of active exploitation. The company says successful access may lead to root-level command execution. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalogue the same day.

Cisco says no workaround addresses the flaw, although an infrastructure access-control list can restrict management traffic as a temporary mitigation. Its advisory recommends upgrading to a fixed release and reviewing access logs on every node. It also warns that root-level access could let an attacker hide or remove evidence. The advisory lists affected ISE and ISE-PIC releases regardless of device configuration; it does not give a victim count or identify the actor.

The KEV entry confirms evidence of exploitation somewhere. It does not establish that any specific customer was attacked. Administrators should use Cisco’s release table to match the fix to their installed branch.